Featured in Architecture & Design

Monal Daxini presents a blueprint for streaming data architectures and a review of desirable features of a streaming engine. He also talks about streaming application patterns and anti-patterns, and use cases and concrete examples using Apache Flink.

Featured in AI, ML & Data Engineering

Joy Gao talks about how database streaming is essential to WePay's infrastructure and the many functions that database streaming serves. She provides information on how the database streaming infrastructure was created & managed so that others can leverage their work to develop their own database streaming solutions. She goes over challenges faced with streaming peer-to-peer distributed databases.

Critical REXML DoS Found - Monkey Patch Available as Fix

XML entities are the cause of a new DoS vulnerability in REXML. A document that defines and uses recursively nested entities will cause excessive expansion of these entities, eventually bringing down the application.

Rails is particularly vulnerable to the problem because it uses REXML to parse incoming XML requests. Since this happens by default and based on the request's document type, this vulnerability is a danger for all Rails applications, unless they have disabled features that automatically handle user provided XML.

At the moment, all Ruby versions up to 1.8.6-p287, 1.8.7-p72 and all Ruby 1.9.x have the problem. A quick experiment with a current JRuby 1.1.x release, parsing the provided sample XML document, also ends with an OutOfMemoryError. (Note: the problem is only triggered when entities are expanded, which means simply parsing is not a problem - the text nodes containing the entities must be accessed for the problem to occur).

Until a fix in REXML is made available, a fix is provided as a monkey patch to the Document and Entity classes in the REXML module. The patch basically limits the number of expanded entities (the limit is configurable) and throws an exception once the limit is exceeded.